Automated summary

Verifies that a repository's README and its install, run, and test instructions actually work from a fresh clone, producing structured evidence and minimal fixes.

Strengths

Cleanly separates audit mode (no execution) from prove mode (with execution), keeping risk contained
Emits a machine-readable JSON report plus a dry-run patch of proposed fixes before anything is edited
Reports only what the evidence supports and explicitly flags unproven claims as unproven
Ships guidance for adding a GitHub Action that continuously checks README truthfulness

Limitations

Assumes scripts/repoproof.mjs already exists in the repo but does not explain how to obtain it
Prove mode requires explicit user approval or a CI runner, so it cannot run fully autonomously
Makes no strong sandboxing claim: execution outside a real container or OS sandbox is acknowledged as unisolated

When to use it

Use it when a maintainer needs evidence-backed confirmation that the README instructions work for a brand-new user cloning the repo.

When not to use it

Avoid it for ordinary README writing, generic code review, or QA checklists that do not require fresh-clone execution evidence.

Security analysis

Safe

Quality score85/100

The skill is an audit/evidence tool whose default mode is read-only and which explicitly requires opt-in (`--allow-exec`) before executing repository code — that is a well-handled powerful capability rather than a hidden one. The only real risk is that prove mode, once approved, executes untrusted repo scripts, and the referenced helper scripts are not shown, but nothing in the instructions is destructive, obfuscated, or exfiltrating.

Findings

•Prove mode runs `node scripts/repoproof.mjs prove . --allow-exec`, which will execute arbitrary repository install/test/demo code (npm install, test scripts, etc.); this is explicitly gated behind user approval or a CI runner and is off by default.
•The skill depends on `scripts/repoproof.mjs` and several `references/*.md` files that are not included in the provided SKILL.md, so their actual behavior (redaction, sandboxing claims) cannot be verified from this text alone.
•No network exfiltration, no curl|sh, no destructive filesystem commands, no secret reading, no safety-disabling instructions; the Safety Rules explicitly forbid publishing/deploying/pushing/merging and reading user secrets.

How this analysis is made

Examples

Audit a fresh clone

Audit this repository as if I just cloned it: run the repo-proof audit and tell me which README steps for install, run and test are actually supported by evidence.

Prove with execution approval

I approve executing the repository code. Run repo-proof in prove mode with --allow-exec and report which README claims held up and which failed.

Add CI verification

Add a GitHub Action that runs repo-proof on every PR so a broken README install step fails CI, and show me the proposed fixes as a dry-run patch first.

name: repo-proof description: Use this skill when a user needs to prove that a repository README or release instructions work from a fresh clone: audit install/run/test/demo steps, create cleanroom evidence, classify README/script/config/package failures, generate minimal fixes, or add a GitHub Action for README truth verification. Do not use for ordinary README writing, generic code review, broad QA checklists, or tasks that do not require repository-grounded fresh-clone evidence.

RepoProof

Name: RepoProof
Author: Skills Guide Bot

Prove the repository from the point of view of a new user. Treat the README as a contract, not a suggestion.

Default Workflow

Run node scripts/repoproof.mjs audit . --output repoproof-output.
Read repoproof-output/repoproof-report.json before drawing conclusions.
If the user explicitly permits execution, run node scripts/repoproof.mjs prove . --allow-exec --output repoproof-output.
If fixes are requested, run node scripts/repoproof.mjs fix . --dry-run --output repoproof-output and inspect repoproof-fixes.patch.
Report only what the evidence supports. Mark unproven claims as unproven.

Safety Rules

Audit mode is the default and must not execute repository code.
Prove mode requires explicit user approval with --allow-exec or a CI runner.
Never publish, deploy, push, merge, or read user secrets.
Never claim strong sandboxing without a real container, VM, or OS sandbox.
Use deterministic scripts for evidence collection and redaction.

References

Read references/workflow.md for the full audit/prove/fix workflow.
Read references/safety-model.md before executing repository code.
Read references/extraction-rules.md when README step extraction is ambiguous.
Read references/fix-policy.md before proposing edits.
Read references/evidence-schema.md when interpreting reports.
Read references/github-action.md before adding CI.
Read references/platform-notes.md for Windows, macOS, and Linux differences.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/repoproof-mrx3y0sj/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/repoproof-mrx3y0sj' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/repoproof-mrx3y0sj/download' --output '.skill-downloads/repoproof-mrx3y0sj/SKILL.md.part' && mv '.skill-downloads/repoproof-mrx3y0sj/SKILL.md.part' '.skill-downloads/repoproof-mrx3y0sj/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

This file does not provide a usable name/description header for this native procedure. It remains available to download and inspect; use the manual method below.

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/repoproof-mrx3y0sj/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

Supabase Docs Authoring

Documentation

Write, edit, and review Supabase documentation content including guides, tutorials, reference docs, and partials. Follow style guides and MDX/TOML validation rules.

Claude CodeintermediateSafe 108,544

Skills Guide Bot